CVE-2025-15503
Unrestricted File Upload in Sangfor O&M System
Publication date: 2026-01-10
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sangfor | operation_and_maintenance_management_system | to 3.0.8 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized remote code execution on the affected system. An attacker can upload and execute malicious files, such as web shells, gaining control over the server with the privileges of the web server process (often root or tomcat). This compromises the confidentiality, integrity, and availability of the system, potentially allowing data theft, system manipulation, or denial of service. [1, 2, 3]
Can you explain this vulnerability to me?
CVE-2025-15503 is a critical security vulnerability in Sangfor Operation and Maintenance Management System up to version 3.0.8. It exists in the file /fort/trust/version/common/common.jsp, where an attacker can manipulate the 'File' argument to perform an unrestricted file upload without any authentication. This allows the attacker to upload arbitrary files, including malicious ones like .jsp web shells, which are saved in the web root directory and can be executed remotely. This leads to remote command execution with the privileges of the web server process, potentially compromising the entire system. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for the presence of the vulnerable endpoint `/fort/trust/version/common/common.jsp` on your system or network. You can use Google dorking with the query `inurl:fort/trust/version/common/common.jsp` to identify potentially vulnerable targets. Additionally, you can look for suspicious HTTP POST requests to this endpoint that include multipart/form-data uploads with files named with executable extensions like `.jsp`. A proof-of-concept involves sending a crafted POST request to upload a JSP web shell and then accessing it via a browser. Commands to detect might include using curl or wget to test the upload functionality, for example: `curl -X POST -F "[email protected]" https://<TARGET_IP>:5533/fort/trust/version/common/common.jsp` and then checking if the file is accessible at `https://<TARGET_IP>:5533/fort/trust/version/common/shell.jsp`. Monitoring web server logs for such POST requests or unexpected file uploads in the `/fort/trust/version/common/` directory can also help detect exploitation attempts. [1, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting or disabling access to the vulnerable endpoint `/fort/trust/version/common/common.jsp`. Enforce strict authentication on the `/fort/trust/` directory or specifically on `common.jsp` to prevent unauthenticated uploads. Implement a whitelist for allowed file types, allowing only safe extensions such as `.jpg`, `.png`, and `.txt`, while rejecting executable extensions like `.jsp`, `.jspx`, and `.sh`. Additionally, configure the web server to disable script execution in the upload directory to prevent execution of uploaded malicious files. Since no official patch or vendor response is available, consider replacing the affected product or component if possible. [1, 3]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated remote attackers to upload and execute arbitrary files, leading to potential compromise of confidentiality, integrity, and availability of the system. Such a compromise can result in unauthorized access to sensitive data, which may violate compliance requirements of standards and regulations like GDPR and HIPAA that mandate protection of personal and health information. However, no specific compliance impact or regulatory references are detailed in the provided resources. [1, 2, 3]